Looking for On-Demand Tech Support?
Techmate has the boots-on-the-ground IT Support where and when you need it.
Schedule a Discovery CallSecurity Camera and Access Control Installs: Where IT Field Services and Facilities Meet
Quick answer: Networked security cameras and access control run on IT infrastructure (switches, PoE, VLANs, storage and remote access), but facilities or security teams usually own them and specialized integrators install them. Techmate’s IT field services cover the network side in 450+ US cities: define ownership, segment devices, plan power and bandwidth, then test jointly before sign-off.
Security cameras and badge readers used to be analog systems that facilities managed end to end. Today they are IP devices on your network, with cloud management, video storage and mobile credentials. That puts them squarely between IT and facilities, and projects stall because neither side is sure who owns the switch port, the firewall rule or the firmware update. Pairing the integrator with onsite IT network services for the closet work is usually what gets a stalled install moving again.
This guide covers how to plan networked physical security installs so IT, facilities and integrators work together cleanly, whether you are fitting out one office or rolling out cameras and readers across dozens of branches.
Why do camera and access control projects stall between IT and facilities?
Most stalls come from three gaps: nobody owns the network requirements, the integrator arrives before the closet is ready, and nobody has agreed who will patch and monitor the devices after go-live. Each gap is small on its own. Together they turn a two-day install into a month of return trips.
The risk side matters too. Forescout’s research team lists NVRs and IP cameras among the riskiest IoT device types on business networks, and ranks retail and financial services as the riskiest sectors on average (Forescout, 2025). Those are exactly the multi-location businesses with the most cameras and doors to manage. A camera project is a network project, and it deserves the same change control as a new firewall or VPN.
Common signs a project is headed for trouble:
- The integrator’s quote says “network by others” and nobody has told IT
- No one has checked whether the closet switch has enough PoE budget or free ports
- Cameras are planned for the corporate VLAN “temporarily”
- The vendor wants a permanent remote access tool installed on a recorder
- There is no named owner for firmware updates after the warranty period
Who owns what in a security camera and access control install?
Write ownership down before the project starts, and attach it to the integrator’s statement of work. The split below is typical for corporate offices and branch networks.
| Responsibility | Primary owner | IT’s role |
|---|---|---|
| System selection and security policy | Security or facilities | Review platform security, cloud architecture and integration needs |
| Camera and reader placement | Security or facilities | Confirm cable paths and closet distances |
| Low-voltage wiring and door hardware | Security integrator (licensed as required) | Approve cable standards and labeling |
| Network design (VLANs, firewall rules) | IT | Owns fully |
| Switch ports and PoE | IT | Owns fully; field technicians execute onsite |
| Video storage and retention | IT and security jointly | Size storage, back up configuration, enforce retention |
| Remote access and cloud management | IT with security | Approve methods, manage accounts, review logs |
| Ongoing firmware and device updates | Agreed between IT and integrator | Track versions and schedule maintenance windows |
Two lines in that table cause most disputes: storage and firmware. Settle them in writing. If the integrator owns firmware, the contract should say how quickly they apply critical patches and how they notify IT. If IT owns it, IT needs admin access and a device inventory from day one.
What network requirements do IP cameras and badge readers have?
Cameras and access control panels look simple, but they place steady, specific demands on the network. Cover these in the design review:
- Segmentation: Put cameras, recorders and access control on their own VLAN or network segment. Allow only the traffic the platform needs (recorder to camera, controller to cloud, viewing clients to recorder) and deny everything else by default.
- PoE budget: Most cameras and many readers and controllers draw PoE. Add up the per-device draw against the switch’s total power budget, and leave headroom for heaters on outdoor cameras and PTZ motors.
- Ports and distance: Count free switch ports per closet and confirm every device is within the 100-meter copper limit, or plan an extender or a closer IDF.
- Bandwidth: Continuous video streams add up quickly, especially with high resolution, high frame rates or cloud upload. Size uplinks and WAN circuits for peak load, not average.
- Storage: Size local recorders or cloud storage to the retention policy, and confirm what happens when the disk fills (overwrite oldest, or alert).
- Addressing: Use DHCP reservations or a documented static range so devices do not move after a power event.
- Time sync: Point every device at a reliable NTP source. Timestamps that drift weaken video as evidence and make access logs hard to correlate.
- Remote access: Use the platform’s secure cloud service or your VPN. Never port-forward cameras or recorders to the internet.
PoE class is the detail most often missed in closet planning. Use this as a quick reference when checking switch specs against device datasheets.
| PoE standard | Power at switch port | Typical security devices |
|---|---|---|
| 802.3af (PoE) | Up to 15.4 W | Fixed indoor cameras, card readers, intercom stations |
| 802.3at (PoE+) | Up to 30 W | Multi-sensor cameras, door controllers powering locks and readers |
| 802.3bt Type 3 | Up to 60 W | PTZ cameras, outdoor cameras with heaters |
| 802.3bt Type 4 | Up to 90 W | High-draw PTZ units and specialty devices |
If the closet switch cannot carry the load, budget for a dedicated PoE switch for the security VLAN. It also makes isolation and troubleshooting easier.
What are the cyber risks of networked cameras and access control?
Physical security devices can quietly become cyber security risks. The usual culprits:
- Default credentials left unchanged on cameras, recorders and controllers
- Outdated firmware with known vulnerabilities
- Direct internet exposure of cameras or recorders through port forwarding
- Flat networks where a compromised camera can reach business systems
- Unmanaged vendor remote access through always-on tools or shared accounts
These are not hypothetical. Verizon’s 2025 Data Breach Investigations Report found that exploitation of edge devices and VPNs grew from 3% to 22% of vulnerability exploitation actions, and that breaches involving a third party doubled from 15% to 30% (Infosecurity Magazine on the Verizon DBIR, 2025). Security integrators with remote access to your recorders are exactly that kind of third party.
Require the integrator to change default credentials, apply current firmware before go-live, and use approved remote access methods only. See how to give remote hands technicians secure, time-bound access for vendor access principles that apply equally to security integrators.
How does a camera and access control install flow from design to sign-off?
A clean install follows the same eight steps whether it is one door or a full building.
- Design: Security defines camera views, door schedules and retention needs. IT defines VLANs, firewall rules, PoE budget, addressing and remote access.
- Cabling: The integrator or a cabling contractor runs low-voltage cable to each device location, labeled to your standard. See structured cabling projects for what to require.
- Network prep: IT configures switch ports, VLANs, PoE and firewall rules, and produces a port map before install day.
- Device install: The integrator mounts cameras, readers, locks and door hardware.
- Connection: A field IT technician or the integrator patches each device to the port map and confirms link, power and VLAN.
- Configuration: The integrator configures the security platform, while IT confirms the devices behave correctly on the network.
- Testing: Joint testing of video, recording, access events, remote viewing, alerts and isolation.
- Documentation: Device list with locations, MAC and IP addresses, port map, photos of closets and mounts, and credentials stored in your password vault.
Steps 3 and 5 are where projects most often slip. If the port map is not ready, the integrator either waits on site or plugs devices into whatever port is free, and someone has to untangle that later.
Where do IT field services fit on install day?
IT field services handle the network work that the integrator is not scoped for and your central team cannot do remotely. An IT field technician onsite commonly handles:
- Installing and racking a dedicated PoE switch for the security VLAN
- Verifying PoE delivery and link at each port
- Patching and connecting devices per the port map
- Testing network connectivity at device locations
- Installing recorders or video servers in racks, with power and UPS connections
- Coordinating with the integrator so cameras and readers come online in order
- Photographing closets and documenting device locations and connections
This keeps the integrator focused on the security platform and gives IT confidence that the network side matches the design. Your central network team stays remote, pushes configuration and watches the devices appear, while the technician is their hands in the closet.
How do you roll out cameras and access control across many locations?
For multi-location companies, the challenge is consistency. Twenty branches installed by four integrators can end up with twenty different network designs unless IT sets the standard first. Nationwide IT field services help here because one coordinated team applies the same closet standard everywhere, while local integrators handle the licensed security work. Treat it as a program, and use IT project and rollout field support to keep the network side on schedule.
A practical rollout sequence:
- Build a site standard: VLAN numbering, firewall templates, switch model, PoE headroom, labeling, naming and documentation format.
- Survey each site: Closet photos, free ports, PoE budget, UPS capacity and WAN bandwidth. Flag sites that need a switch or circuit upgrade.
- Pilot one or two sites: Run the full flow, fix the runbook and confirm testing criteria before scaling.
- Schedule in waves: Group sites by region and integrator, and book field technicians to the same windows as the integrator.
- Use a per-site closeout packet: Test results, photos, port map and device inventory, reviewed before the site is marked complete.
What this looks like varies by industry:
- Bank and credit union branches: Cameras at teller lines, ATMs and vaults, with strict retention and audit needs. Network isolation and logging matter as much as the video. See IT services for banks.
- Retail stores: Many cameras per site, limited closet space and small WAN circuits. Bandwidth planning and local recording are critical.
- Law firms and professional services: Fewer cameras, more access control: suites, file rooms and server rooms, often integrated with visitor management.
- Real estate and shared buildings: Landlord and tenant systems often overlap. Clarify which network each device lives on and who controls the base building system.
What should be tested before sign-off?
Do not accept the install until both IT and security have signed this list for every site.
| Test | How to check | Pass criteria |
|---|---|---|
| Video | View every camera live from the platform | Each camera streams and frames the intended area, day and night |
| Recording | Play back footage from several hours earlier | Video records and retains per policy, with correct timestamps |
| Remote viewing | Log in as an authorized remote user | Viewing works through approved methods only |
| Access events | Badge in at each reader with test credentials | Doors unlock and events log with the right user and time |
| Door alarms | Prop and force each monitored door | Held-open and forced-door alerts reach the right people |
| Network isolation | Attempt to reach business systems from the security VLAN | Traffic is blocked and logged |
| Power loss | Simulate loss of power to the switch or controller | Doors fail safe or fail secure as policy requires; devices return without manual work |
What mistakes cause rework on security installs?
- Skipping the PoE math: Cameras that reboot at night when IR and heaters kick in are almost always a power budget problem.
- “Temporary” corporate VLAN placement: Temporary becomes permanent. Build the security VLAN first.
- No port map: Devices end up on random ports, and future troubleshooting takes twice as long.
- Credentials in the integrator’s spreadsheet only: Store admin credentials in your own vault before the integrator leaves.
- Ignoring the UPS: If the closet loses power, cameras go dark and doors may lock or unlock depending on hardware. Size the UPS for the security load.
- No firmware owner: Without a named owner, devices stay on install-day firmware for years.
How should IT field services coordinate with security integrators?
Share a pre-install packet at least a week before install day: port map, VLAN and IP details, closet access instructions, site contact and the testing checklist. Confirm the integrator’s schedule and book the field technician for the same window, with a short call at the start of the day to agree on order of work.
On site, the field technician connects and tests devices while the integrator configures the platform. Before anyone leaves, both sign the test checklist and upload photos and documentation. After go-live, agree on a single support path: who the branch calls when a camera goes offline, and how the integrator and IT hand off between network and platform issues.
The bottom line
Networked cameras and access control succeed when IT, facilities and integrators each know their role. Define ownership, segment the network, plan PoE and bandwidth, secure devices from day one and coordinate IT field services for network connections and testing. The result is physical security that does not create new cyber risk.
Techmate supports the network side of physical security installs across 450+ US cities, with more than 7,000 vetted technicians in its network. See IT network services or contact us.
Frequently Asked Questions
Who should manage security cameras, IT or facilities?
Usually both. Facilities or security typically own the system, camera placement and policy, while IT owns the network, segmentation, storage, remote access and patching standards. The split works when it is written down before the project starts and attached to the integrator’s statement of work, so nobody is guessing who owns a switch port or a firmware update.
Should security cameras be on a separate network?
Yes. Put cameras, recorders and access control on their own VLAN or network segment, and allow only the traffic the platform needs. If a camera is compromised, segmentation keeps the attacker away from business systems. A dedicated PoE switch for the security VLAN also makes power planning and troubleshooting simpler at each site.
What network requirements do IP cameras have?
IP cameras need enough PoE capacity on the switch, available ports within 100 meters of copper, bandwidth sized for continuous streams, storage that matches the retention policy, stable addressing, accurate time synchronization and a secure remote access method. Outdoor and PTZ cameras often need higher PoE classes, so check datasheets against switch specs before install day.
What are the cyber risks of security cameras?
The main risks are default credentials, outdated firmware, devices exposed directly to the internet, flat networks that let a compromised camera reach business systems, and unmanaged vendor remote access. Each one is preventable with a simple standard: change credentials at install, patch before go-live, segment the network and require approved, logged remote access.
Can IT technicians install security cameras?
IT technicians commonly handle the network side: switches, PoE verification, patching, connectivity testing and recorder installation. Licensed security integrators usually handle device mounting, low-voltage wiring and door hardware, where state or local licensing applies. Splitting the work this way keeps each team inside its expertise and keeps the install on schedule.
What should be tested after an access control install?
Test badge reads at every reader, door unlocking and event logging, held-open and forced-door alerts, remote management access, network isolation from business systems, and door behavior during power loss. Both IT and security should sign off on the results, with photos and a device inventory saved in the site’s documentation.
How do you standardize camera installs across many branches?
Build a site standard first (VLANs, firewall templates, switch model, labeling and documentation), survey each site, pilot one or two locations, then roll out in regional waves. Use nationwide IT field services for consistent closet work and require a closeout packet with test results and photos before each site is marked complete.
Planning a camera or access control rollout across multiple offices or branches? Book a free 30-minute IT support audit and we will review your sites, closets and coverage plan with you.
